@mastra/server 1.80.0-alpha.3 → 1.80.0-alpha.5

package/dist/{utils-BBJlS81s.js → utils-DHxjw4Tn.js}

@@ -1,8 +1,8 @@
-import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
-import { m as isReservedRequestContextKey, o as MASTRA_RESOURCE_ID_KEY } from "./constants-DazK_RZj.js";
+import { t as HTTPException } from "./http-exception-CzaWkxMl.js";
+import { m as isReservedRequestContextKey, o as MASTRA_RESOURCE_ID_KEY } from "./constants-ohUUT3Vg.js";
 import * as authEE from "@mastra/core/auth/ee";
 import { MastraMemory } from "@mastra/core/memory";
-//#region src/server/fga-permissions.ts
+// src/server/fga-permissions.ts
 /**
 * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.
 *
@@ -49,8 +49,7 @@ const FALLBACK_PERMISSIONS = {
 };
 const realPermissions = authEE.MastraFGAPermissions;
 const MastraFGAPermissions = realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;
-//#endregion
-//#region src/server/handlers/utils.ts
+// src/server/handlers/utils.ts
 /**
 * Resolves a workflow by id or registration key from the set Mastra exposes
 * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal
@@ -61,6 +60,24 @@ function getPublicWorkflowById(mastra, workflowId) {
 	const workflows = mastra.listWorkflows();
 	return Object.values(workflows).find((workflow) => workflow.id === workflowId) ?? (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : void 0);
 }
+/**
+* Resolves the FGA provider a handler should use for this request, following
+* the same auth-mode-aware selection as the route-level checks: Studio auth
+* requests use `studio.fga` when it is configured, and everything else uses
+* `server.fga`.
+*
+* Returns `undefined` when FGA is not configured at all. When FGA is
+* configured but no provider applies to this request (for example `studio.fga`
+* is set and the request used server auth), the request is denied rather than
+* treated as unrestricted.
+*/
+function getHandlerFGAProvider(mastra, requestContext) {
+	const studioFga = mastra?.getStudio?.()?.fga;
+	const serverFga = mastra?.getServer?.()?.fga;
+	if (requestContext?.get("mastra__authMode") === "studio" && studioFga) return studioFga;
+	if (serverFga) return serverFga;
+	if (studioFga) throw new HTTPException(403, { message: "Access denied: no FGA provider is configured for this request" });
+}
 function validateBody(body) {
 	const errorResponse = Object.entries(body).reduce((acc, [key, value]) => {
 		if (!value) acc[key] = `Argument "${key}" is required`;
@@ -192,7 +209,8 @@ async function validateThreadOwnership(thread, effectiveResourceId) {
 */
 async function enforceThreadAccess({ mastra, requestContext, threadId, thread, effectiveResourceId, permission = MastraFGAPermissions.MEMORY_READ }) {
 	await validateThreadOwnership(thread, effectiveResourceId);
-	if (!mastra?.getServer?.()?.fga) return;
+	const fgaProvider = getHandlerFGAProvider(mastra, requestContext);
+	if (!fgaProvider) return;
 	const user = requestContext?.get("user");
 	if (!user || typeof user !== "object") throw new HTTPException(403, { message: "FGA authorization denied: authenticated user is required" });
 	await MastraMemory.checkThreadFGA({
@@ -201,7 +219,8 @@ async function enforceThreadAccess({ mastra, requestContext, threadId, thread, e
 		threadId,
 		resourceId: thread?.resourceId ?? effectiveResourceId,
 		requestContext,
-		permission
+		permission,
+		fgaProvider
 	});
 }
 /**
@@ -214,10 +233,9 @@ async function enforceThreadAccess({ mastra, requestContext, threadId, thread, e
 * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,
 * as on the thread-transfer route.
 */
-async function validateRunOwnership(run, effectiveResourceId, mastra) {
+async function validateRunOwnership(run, effectiveResourceId, mastra, requestContext) {
 	if (!run) return;
-	const server = mastra?.getServer?.();
-	if (!(typeof (server?.auth)?.mapUserToResourceId === "function")) {
+	if (!(typeof ((mastra?.getServer?.())?.auth)?.mapUserToResourceId === "function")) {
 		if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) throw new HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
 		return;
 	}
@@ -225,9 +243,8 @@ async function validateRunOwnership(run, effectiveResourceId, mastra) {
 		if (run.resourceId !== effectiveResourceId) throw new HTTPException(403, { message: "Access denied: workflow run belongs to a different resource" });
 		return;
 	}
-	if (!server?.fga) throw new HTTPException(403, { message: "Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access." });
+	if (!getHandlerFGAProvider(mastra, requestContext)) throw new HTTPException(403, { message: "Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access." });
 }
-//#endregion
-export { getEffectiveThreadId as a, parseFilters as c, sanitizeBody as d, stripClientCredentialHeaders as f, MastraFGAPermissions as g, validateThreadOwnership as h, getEffectiveResourceId as i, parsePerPage as l, validateRunOwnership as m, enforceThreadAccess as n, getPublicWorkflowById as o, validateBody as p, getContextResourceId as r, mergeBodyRequestContext as s, applyEffectiveThreadId as t, requireEffectiveResourceId as u };
+export { MastraFGAPermissions as _, getEffectiveThreadId as a, mergeBodyRequestContext as c, requireEffectiveResourceId as d, sanitizeBody as f, validateThreadOwnership as g, validateRunOwnership as h, getEffectiveResourceId as i, parseFilters as l, validateBody as m, enforceThreadAccess as n, getHandlerFGAProvider as o, stripClientCredentialHeaders as p, getContextResourceId as r, getPublicWorkflowById as s, applyEffectiveThreadId as t, parsePerPage as u };
 
-//# sourceMappingURL=utils-BBJlS81s.js.map
+//# sourceMappingURL=utils-DHxjw4Tn.js.map

package/dist/utils-DHxjw4Tn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-DHxjw4Tn.js","names":[],"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  STORED_WORKFLOWS_READ: 'stored-workflows:read',\n  STORED_WORKFLOWS_WRITE: 'stored-workflows:write',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { Mastra } from '@mastra/core';\nimport type { IFGAProvider, MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport type { Workflow } from '@mastra/core/workflows';\nimport {\n  MASTRA_AUTH_MODE_KEY,\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_THREAD_ID_KEY,\n  isReservedRequestContextKey,\n} from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n/**\n * Resolves a workflow by id or registration key from the set Mastra exposes\n * publicly. Unlike `mastra.getWorkflowById`, this excludes hidden internal\n * workflows (e.g. a durable agent's backing loop), which must never be\n * runnable through HTTP routes.\n */\nexport function getPublicWorkflowById(mastra: Mastra, workflowId: string): Workflow | undefined {\n  const workflows = mastra.listWorkflows();\n  return (\n    Object.values(workflows).find(workflow => workflow.id === workflowId) ??\n    (Object.hasOwn(workflows, workflowId) ? workflows[workflowId] : undefined)\n  );\n}\n\n/**\n * Resolves the FGA provider a handler should use for this request, following\n * the same auth-mode-aware selection as the route-level checks: Studio auth\n * requests use `studio.fga` when it is configured, and everything else uses\n * `server.fga`.\n *\n * Returns `undefined` when FGA is not configured at all. When FGA is\n * configured but no provider applies to this request (for example `studio.fga`\n * is set and the request used server auth), the request is denied rather than\n * treated as unrestricted.\n */\nexport function getHandlerFGAProvider(mastra: any, requestContext?: RequestContext): IFGAProvider | undefined {\n  const studioFga = mastra?.getStudio?.()?.fga as IFGAProvider | undefined;\n  const serverFga = mastra?.getServer?.()?.fga as IFGAProvider | undefined;\n\n  if (requestContext?.get(MASTRA_AUTH_MODE_KEY) === 'studio' && studioFga) return studioFga;\n  if (serverFga) return serverFga;\n  if (studioFga) {\n    throw new HTTPException(403, { message: 'Access denied: no FGA provider is configured for this request' });\n  }\n  return undefined;\n}\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nconst CREDENTIAL_HEADER_NAMES = new Set([\n  'authorization',\n  'proxy-authorization',\n  'x-api-key',\n  'api-key',\n  'x-goog-api-key',\n  'cookie',\n]);\n\n/**\n * Removes credential-bearing headers from client-supplied `modelSettings.headers`\n * so a caller's own auth (e.g. the app's bearer token) can never override the\n * provider credential configured on the server. Non-credential headers are kept.\n */\nexport function stripClientCredentialHeaders(body: Record<string, unknown>) {\n  const modelSettings = body.modelSettings;\n  if (!modelSettings || typeof modelSettings !== 'object') return;\n  const headers = (modelSettings as { headers?: unknown }).headers;\n  if (!headers || typeof headers !== 'object') return;\n\n  const kept = Object.fromEntries(\n    Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())),\n  );\n  body.modelSettings = { ...modelSettings, headers: kept };\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n/**\n * Merges a body-supplied requestContext into the trusted server RequestContext.\n * The server context is authoritative: reserved keys are skipped and body values\n * only fill keys the server context has not already set.\n */\nexport function mergeBodyRequestContext(serverRequestContext: RequestContext, bodyRequestContext: unknown): void {\n  if (!bodyRequestContext || typeof bodyRequestContext !== 'object') {\n    return;\n  }\n\n  for (const [key, value] of Object.entries(bodyRequestContext)) {\n    if (isReservedRequestContextKey(key)) continue;\n    if (serverRequestContext.get(key) === undefined) {\n      serverRequestContext.set(key, value);\n    }\n  }\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Returns the resource id resolved from the request context alone (set via\n * `mapUserToResourceId` or the `x-resource-id` header), ignoring any\n * client-provided value. Its presence indicates a resource-scoped caller;\n * its absence indicates a privileged/service context.\n */\nexport function getContextResourceId(requestContext: RequestContext | undefined): string | undefined {\n  return requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n}\n\n/**\n * Ensures a memory request has a resolvable resource ID. The body's\n * `memory.resource` is optional so authenticated setups can rely on the\n * server-derived resource ID (MASTRA_RESOURCE_ID_KEY set via mapUserToResourceId).\n * When neither the body nor the request context provides one, reject with a\n * clear 400 instead of failing deep inside agent execution.\n */\nexport function requireEffectiveResourceId(\n  effectiveResourceId: string | undefined,\n): asserts effectiveResourceId is string {\n  if (!effectiveResourceId) {\n    throw new HTTPException(400, {\n      message:\n        'A resource ID is required when using memory. Provide memory.resource in the request body, or configure server auth with mapUserToResourceId to derive it from the authenticated user.',\n    });\n  }\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Applies the effective threadId to a client memory thread option. Object\n * threads keep their other fields (metadata, title, ...) so they reach thread\n * creation; a client-supplied resourceId is dropped because the server decides\n * the resource.\n */\nexport function applyEffectiveThreadId<T extends string | { id: string } | undefined>(\n  thread: T,\n  effectiveThreadId: string | undefined,\n): T | string {\n  if (!effectiveThreadId) return thread;\n  if (thread && typeof thread === 'object') {\n    const { resourceId: _resourceId, ...fields } = thread as { id: string; resourceId?: unknown };\n    return { ...fields, id: effectiveThreadId } as T;\n  }\n  return effectiveThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when no FGA provider is configured.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n    fgaProvider,\n  });\n}\n\n/**\n * Validates that a caller may act on a workflow run.\n *\n * Without `server.auth.mapUserToResourceId` there is no tenancy model, and only a mismatch\n * between two present resource ids is denied. With a mapper, a resource-scoped caller may only\n * act on runs it owns (an owner-less run is not its run). An unscoped caller is a\n * privileged/service context (see getContextResourceId), but that privilege is only granted when\n * an FGA provider authorizes the route; otherwise it is refused rather than granted implicitly,\n * as on the thread-transfer route.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n  mastra?: {\n    getServer?: () => { auth?: unknown; fga?: unknown } | undefined;\n    getStudio?: () => { fga?: unknown } | undefined;\n  },\n  requestContext?: RequestContext,\n): Promise<void> {\n  if (!run) return;\n  const server = mastra?.getServer?.();\n  const tenancy =\n    typeof (server?.auth as { mapUserToResourceId?: unknown } | undefined)?.mapUserToResourceId === 'function';\n  if (!tenancy) {\n    if (effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (effectiveResourceId) {\n    if (run.resourceId !== effectiveResourceId) {\n      throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n    }\n    return;\n  }\n  if (!getHandlerFGAProvider(mastra, requestContext)) {\n    throw new HTTPException(403, {\n      message:\n        'Access denied: unscoped workflow run access requires explicit authorization. Configure an FGA provider to authorize privileged run access.',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAM,uBAAuB;CAC3B,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,aAAa;CACb,eAAe;CACf,aAAa;CACb,cAAc;CACd,eAAe;CACf,YAAY;CACZ,uBAAuB;CACvB,wBAAwB;CACxB,mBAAmB;CACnB,gBAAgB;AAClB;AAEA,MAAM,kBAAmB,OAAe;AAQxC,MAAa,uBACX,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,IAAI,kBAAkB;;;;;;;;ACzCjF,SAAgB,sBAAsB,QAAgB,YAA0C;CAC9F,MAAM,YAAY,OAAO,cAAc;CACvC,OACE,OAAO,OAAO,SAAS,CAAC,CAAC,MAAK,aAAY,SAAS,OAAO,UAAU,MACnE,OAAO,OAAO,WAAW,UAAU,IAAI,UAAU,cAAc,KAAA;AAEpE;;;;;;;;;;;;AAaA,SAAgB,sBAAsB,QAAa,gBAA2D;CAC5G,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CACzC,MAAM,YAAY,QAAQ,YAAY,CAAC,EAAE;CAEzC,IAAI,gBAAgB,IAAA,kBAAwB,MAAM,YAAY,WAAW,OAAO;CAChF,IAAI,WAAW,OAAO;CACtB,IAAI,WACF,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,gEAAgE,CAAC;AAG7G;AAGA,SAAgB,aAAa,MAA+B;CAC1D,MAAM,gBAAgB,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAgC,KAAK,CAAC,KAAK,WAAW;EAC/F,IAAI,CAAC,OACH,IAAI,OAAO,aAAa,IAAI;EAE9B,OAAO;CACT,GAAG,CAAC,CAAC;CAEL,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,GACtC,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,OAAO,OAAO,aAAa,CAAC,CAAC,GAAG,CAAC;AAE7E;;;;;;AAOA,SAAgB,aAAa,MAA+B,gBAA0B;CACpF,KAAK,MAAM,OAAO,gBAChB,IAAI,OAAO,MACT,OAAO,KAAK;AAGlB;AAEA,MAAM,0CAA0B,IAAI,IAAI;CACtC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,6BAA6B,MAA+B;CAC1E,MAAM,gBAAgB,KAAK;CAC3B,IAAI,CAAC,iBAAiB,OAAO,kBAAkB,UAAU;CACzD,MAAM,UAAW,cAAwC;CACzD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;CAE7C,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,IAAI,KAAK,YAAY,CAAC,CAAC,CAC7F;CACA,KAAK,gBAAgB;EAAE,GAAG;EAAe,SAAS;CAAK;AACzD;AAEA,SAAgB,aACd,OACA,eAAuB,KACvB,MAAc,KACE;CAGhB,KAFoB,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,YAE3B,MAAM,SACjB,OAAO;CAET,MAAM,SAAS,SAAS,SAAS,OAAO,YAAY,GAAG,EAAE;CACzD,IAAI,MAAM,MAAM,GAAG,OAAO;CAC1B,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC1C;;;;AAKA,SAAgB,aAAa,SAA4E;CACvG,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,OAAO,OAAO,aACX,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO,EAAA,CAAG,KAAK,SAAiB;EACnE,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,GAAG;EAE3C,OAAO,CAAC,KADM,WAAW,KAAK,GACb,CAAC;CACpB,CAAC,CACH;AACF;;;;;;AAOA,SAAgB,wBAAwB,sBAAsC,oBAAmC;CAC/G,IAAI,CAAC,sBAAsB,OAAO,uBAAuB,UACvD;CAGF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,kBAAkB,GAAG;EAC7D,IAAI,4BAA4B,GAAG,GAAG;EACtC,IAAI,qBAAqB,IAAI,GAAG,MAAM,KAAA,GACpC,qBAAqB,IAAI,KAAK,KAAK;CAEvC;AACF;;;;;AAUA,SAAgB,uBACd,gBACA,kBACoB;CAEpB,OAD0B,gBAAgB,IAAA,oBAA0B,KACxC;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,gBAAgE;CACnG,OAAO,gBAAgB,IAAI,sBAAsB;AACnD;;;;;;;;AASA,SAAgB,2BACd,qBACuC;CACvC,IAAI,CAAC,qBACH,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,wLACJ,CAAC;AAEL;;;;;AAMA,SAAgB,qBACd,gBACA,gBACoB;CAEpB,OADwB,gBAAgB,IAAA,kBAAwB,KACtC;AAC5B;;;;;;;AAQA,SAAgB,uBACd,QACA,mBACY;CACZ,IAAI,CAAC,mBAAmB,OAAO;CAC/B,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,EAAE,YAAY,aAAa,GAAG,WAAW;EAC/C,OAAO;GAAE,GAAG;GAAQ,IAAI;EAAkB;CAC5C;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,wBACpB,QACA,qBACe;CACf,IAAI,UAAU,uBAAuB,OAAO,cAAc,OAAO,eAAe,qBAC9E,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,wDAAwD,CAAC;AAErG;;;;;AAMA,eAAsB,oBAAoB,EACxC,QACA,gBACA,UACA,QACA,qBACA,aAAa,qBAAqB,eAQlB;CAChB,MAAM,wBAAwB,QAAQ,mBAAmB;CAEzD,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,IAAI,CAAC,aACH;CAGF,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2DAA2D,CAAC;CAGtG,MAAM,aAAa,eAAe;EAChC;EACM;EACN;EACA,YAAY,QAAQ,cAAc;EAClC;EACA;EACA;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,qBACpB,KACA,qBACA,QAIA,gBACe;CACf,IAAI,CAAC,KAAK;CAIV,IAAI,EADF,SAFa,QAAQ,YAAY,EAAA,EAEjB,KAAA,EAAwD,wBAAwB,aACpF;EACZ,IAAI,uBAAuB,IAAI,cAAc,IAAI,eAAe,qBAC9D,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,qBAAqB;EACvB,IAAI,IAAI,eAAe,qBACrB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8DAA8D,CAAC;EAEzG;CACF;CACA,IAAI,CAAC,sBAAsB,QAAQ,cAAc,GAC/C,MAAM,IAAI,cAAc,KAAK,EAC3B,SACE,6IACJ,CAAC;AAEL"}

package/dist/{utils-aoLN3Wfi.js → utils-YEuwVEc2.js}

@@ -1,7 +1,7 @@
-import { t as HTTPException } from "./http-exception-CyfxZB6W.js";
-import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "./schema-CzbEIyhE-BsMcj9Ws.js";
-import { o as MASTRA_RESOURCE_ID_KEY } from "./constants-DazK_RZj.js";
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/double-indexed-kv.js
+import { t as HTTPException } from "./http-exception-CzaWkxMl.js";
+import { n as standardSchemaToJSONSchema, r as toStandardSchema } from "./schema-Bf12g7KC-DBc4NSds.js";
+import { o as MASTRA_RESOURCE_ID_KEY } from "./constants-ohUUT3Vg.js";
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/double-indexed-kv.js
 var DoubleIndexedKV = class {
 	constructor() {
 		this.keyToValue = /* @__PURE__ */ new Map();
@@ -22,8 +22,7 @@ var DoubleIndexedKV = class {
 		this.valueToKey.clear();
 	}
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/registry.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/registry.js
 var Registry = class {
 	constructor(generateIdentifier) {
 		this.generateIdentifier = generateIdentifier;
@@ -44,8 +43,7 @@ var Registry = class {
 		return this.kv.getByKey(identifier);
 	}
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/class-registry.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/class-registry.js
 var ClassRegistry = class extends Registry {
 	constructor() {
 		super((c) => c.name);
@@ -61,8 +59,7 @@ var ClassRegistry = class extends Registry {
 		return this.classToAllowedProps.get(value);
 	}
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/util.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/util.js
 function valuesOfObj(record) {
 	if ("values" in Object) return Object.values(record);
 	const values = [];
@@ -90,8 +87,7 @@ function findArr(record, predicate) {
 		if (predicate(value)) return value;
 	}
 }
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/custom-transformer-registry.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/custom-transformer-registry.js
 var CustomTransformerRegistry = class {
 	constructor() {
 		this.transfomers = {};
@@ -106,9 +102,8 @@ var CustomTransformerRegistry = class {
 		return this.transfomers[name];
 	}
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/is.js
-const getType$1 = (payload) => Object.prototype.toString.call(payload).slice(8, -1);
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/is.js
+const getType = (payload) => Object.prototype.toString.call(payload).slice(8, -1);
 const isUndefined = (payload) => typeof payload === "undefined";
 const isNull = (payload) => payload === null;
 const isPlainObject$1 = (payload) => {
@@ -118,14 +113,14 @@ const isPlainObject$1 = (payload) => {
 	return Object.getPrototypeOf(payload) === Object.prototype;
 };
 const isEmptyObject = (payload) => isPlainObject$1(payload) && Object.keys(payload).length === 0;
-const isArray$1 = (payload) => Array.isArray(payload);
+const isArray = (payload) => Array.isArray(payload);
 const isString = (payload) => typeof payload === "string";
 const isNumber = (payload) => typeof payload === "number" && !isNaN(payload);
 const isBoolean = (payload) => typeof payload === "boolean";
 const isRegExp = (payload) => payload instanceof RegExp;
 const isMap = (payload) => payload instanceof Map;
 const isSet = (payload) => payload instanceof Set;
-const isSymbol = (payload) => getType$1(payload) === "Symbol";
+const isSymbol = (payload) => getType(payload) === "Symbol";
 const isDate = (payload) => payload instanceof Date && !isNaN(payload.valueOf());
 const isError = (payload) => payload instanceof Error;
 const isNaNValue = (payload) => typeof payload === "number" && isNaN(payload);
@@ -134,8 +129,7 @@ const isBigint = (payload) => typeof payload === "bigint";
 const isInfinite = (payload) => payload === Infinity || payload === -Infinity;
 const isTypedArray = (payload) => ArrayBuffer.isView(payload) && !(payload instanceof DataView);
 const isURL = (payload) => payload instanceof URL;
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/pathstringifier.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/pathstringifier.js
 const escapeKey = (key) => key.replace(/\\/g, "\\\\").replace(/\./g, "\\.");
 const stringifyPath = (path) => path.map(String).map(escapeKey).join(".");
 const parsePath = (string, legacyPaths) => {
@@ -167,8 +161,7 @@ const parsePath = (string, legacyPaths) => {
 	result.push(lastSegment);
 	return result;
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/transformer.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/transformer.js
 function simpleTransformation(isApplicable, annotation, transform, untransform) {
 	return {
 		isApplicable,
@@ -311,7 +304,7 @@ simpleRules.forEach((rule) => {
 	simpleRulesByAnnotation[rule.annotation] = rule;
 });
 const untransformValue = (json, type, superJson) => {
-	if (isArray$1(type)) switch (type[0]) {
+	if (isArray(type)) switch (type[0]) {
 		case "symbol": return symbolRule.untransform(json, type, superJson);
 		case "class": return classRule.untransform(json, type, superJson);
 		case "custom": return customRule.untransform(json, type, superJson);
@@ -324,8 +317,7 @@ const untransformValue = (json, type, superJson) => {
 		return transformation.untransform(json, superJson);
 	}
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/accessDeep.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/accessDeep.js
 const getNthKey = (value, n) => {
 	if (n > value.size) throw new Error("index out of bounds");
 	const keys = value.keys();
@@ -365,7 +357,7 @@ const setDeep = (object, path, mapper) => {
 	let parent = object;
 	for (let i = 0; i < path.length - 1; i++) {
 		const key = path[i];
-		if (isArray$1(parent)) {
+		if (isArray(parent)) {
 			const index = +key;
 			parent = parent[index];
 		} else if (isPlainObject$1(parent)) parent = parent[key];
@@ -386,7 +378,7 @@ const setDeep = (object, path, mapper) => {
 		}
 	}
 	const lastKey = path[path.length - 1];
-	if (isArray$1(parent)) parent[+lastKey] = mapper(parent[+lastKey]);
+	if (isArray(parent)) parent[+lastKey] = mapper(parent[+lastKey]);
 	else if (isPlainObject$1(parent)) parent[lastKey] = mapper(parent[lastKey]);
 	if (isSet(parent)) {
 		const oldValue = getNthKey(parent, +lastKey);
@@ -411,13 +403,12 @@ const setDeep = (object, path, mapper) => {
 	}
 	return object;
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/plainer.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/plainer.js
 const enableLegacyPaths = (version) => version < 1;
 function traverse(tree, walker, version, origin = []) {
 	if (!tree) return;
 	const legacyPaths = enableLegacyPaths(version);
-	if (!isArray$1(tree)) {
+	if (!isArray(tree)) {
 		forEach(tree, (subtree, key) => traverse(subtree, walker, version, [...origin, ...parsePath(key, legacyPaths)]));
 		return;
 	}
@@ -441,7 +432,7 @@ function applyReferentialEqualityAnnotations(plain, annotations, version) {
 			plain = setDeep(plain, identicalObjectPath, () => object);
 		});
 	}
-	if (isArray$1(annotations)) {
+	if (isArray(annotations)) {
 		const [root, other] = annotations;
 		root.forEach((identicalPath) => {
 			plain = setDeep(plain, parsePath(identicalPath, legacyPaths), () => plain);
@@ -450,7 +441,7 @@ function applyReferentialEqualityAnnotations(plain, annotations, version) {
 	} else forEach(annotations, apply);
 	return plain;
 }
-const isDeep = (object, superJson) => isPlainObject$1(object) || isArray$1(object) || isMap(object) || isSet(object) || isError(object) || isInstanceOfRegisteredClass(object, superJson);
+const isDeep = (object, superJson) => isPlainObject$1(object) || isArray(object) || isMap(object) || isSet(object) || isError(object) || isInstanceOfRegisteredClass(object, superJson);
 function addIdentity(object, path, identities) {
 	const existingSet = identities.get(object);
 	if (existingSet) existingSet.push(path);
@@ -490,13 +481,13 @@ const walker = (object, identities, superJson, dedupe, path = [], objectsInThisP
 	if (includes(objectsInThisPath, object)) return { transformedValue: null };
 	const transformationResult = transformValue(object, superJson);
 	const transformed = transformationResult?.value ?? object;
-	const transformedValue = isArray$1(transformed) ? [] : {};
+	const transformedValue = isArray(transformed) ? [] : {};
 	const innerAnnotations = {};
 	forEach(transformed, (value, index) => {
 		if (index === "__proto__" || index === "constructor" || index === "prototype") throw new Error(`Detected property ${index}. This is a prototype pollution risk, please remove it from your object.`);
 		const recursiveResult = walker(value, identities, superJson, dedupe, [...path, index], [...objectsInThisPath, object], seenObjects);
 		transformedValue[index] = recursiveResult.transformedValue;
-		if (isArray$1(recursiveResult.annotations)) innerAnnotations[escapeKey(index)] = recursiveResult.annotations;
+		if (isArray(recursiveResult.annotations)) innerAnnotations[escapeKey(index)] = recursiveResult.annotations;
 		else if (isPlainObject$1(recursiveResult.annotations)) forEach(recursiveResult.annotations, (tree, key) => {
 			innerAnnotations[escapeKey(index) + "." + key] = tree;
 		});
@@ -511,35 +502,18 @@ const walker = (object, identities, superJson, dedupe, path = [], objectsInThisP
 	if (!primitive) seenObjects.set(object, result);
 	return result;
 };
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/is-what/5.5.0/6a17e1f04f109bfa55bd3a32beb0649d4f15de71496a7b56ad89c5617c48dbcf/node_modules/is-what/dist/getType.js
-/** Returns the object type of the given payload */
-function getType(payload) {
-	return Object.prototype.toString.call(payload).slice(8, -1);
-}
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/is-what/5.5.0/6a17e1f04f109bfa55bd3a32beb0649d4f15de71496a7b56ad89c5617c48dbcf/node_modules/is-what/dist/isArray.js
-/** Returns whether the payload is an array */
-function isArray(payload) {
-	return getType(payload) === "Array";
-}
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/is-what/5.5.0/6a17e1f04f109bfa55bd3a32beb0649d4f15de71496a7b56ad89c5617c48dbcf/node_modules/is-what/dist/isPlainObject.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/copy-anything/4.1.5/dedefcf2f03e98e70d41bceb3c3897b84814fa553b00ef4acbcec74c4b246876/node_modules/copy-anything/dist/index.js
 /**
-* Returns whether the payload is a plain JavaScript object (excluding special classes or objects
-* with other prototypes)
+* Assigns a prop the copy is keeping, preserving whether it was enumerable. Callers decide
+* _whether_ to keep a non-enumerable prop before getting here, so by this point the answer is
+* always yes.
 */
-function isPlainObject(payload) {
-	if (getType(payload) !== "Object") return false;
-	const prototype = Object.getPrototypeOf(payload);
-	return !!prototype && prototype.constructor === Object && prototype === Object.prototype;
-}
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/copy-anything/4.0.5/22cc8bea9fb94edd0adbb1b532950c62b530da34e51811884acea49340e0256c/node_modules/copy-anything/dist/index.js
-function assignProp(carry, key, newVal, originalObject, includeNonenumerable) {
-	const propType = {}.propertyIsEnumerable.call(originalObject, key) ? "enumerable" : "nonenumerable";
-	if (propType === "enumerable") carry[key] = newVal;
-	if (includeNonenumerable && propType === "nonenumerable") Object.defineProperty(carry, key, {
+function assignProp(carry, key, newVal, originalObject) {
+	if (Object.prototype.propertyIsEnumerable.call(originalObject, key)) {
+		carry[key] = newVal;
+		return;
+	}
+	Object.defineProperty(carry, key, {
 		value: newVal,
 		enumerable: false,
 		writable: true,
@@ -547,8 +521,42 @@ function assignProp(carry, key, newVal, originalObject, includeNonenumerable) {
 	});
 }
 /**
+* Whether `value` is an object literal, as opposed to a class instance, a built-in like `Date`, an
+* `arguments` object, or an object with a null prototype.
+*
+* The prototype check comes first because it is cheap and rejects almost everything; the tag check
+* is only reached by values that are about to be cloned anyway.
+*/
+function isPlainObject(value) {
+	return Object.getPrototypeOf(value) === Object.prototype && Object.prototype.toString.call(value) === "[object Object]";
+}
+/**
+* Returns the clone that `value` should be replaced with, and queues it to be filled in later.
+* Anything that isn't an array or a plain object is returned untouched.
+*
+* Reusing the clone already registered in `clones` is what makes circular and shared references
+* work: the placeholder is registered before its contents exist, so a reference back to an ancestor
+* resolves to it rather than walking forever.
+*/
+function cloneRef(value, clones, sources, dests) {
+	if (typeof value !== "object" || value === null) return value;
+	const array = Array.isArray(value);
+	if (!array && !isPlainObject(value)) return value;
+	const existing = clones.get(value);
+	if (existing !== void 0) return existing;
+	const clone = array ? new Array(value.length) : {};
+	clones.set(value, clone);
+	sources.push(value);
+	dests.push(clone);
+	return clone;
+}
+/**
 * Copy (clone) an object and all its props recursively to get rid of any prop referenced of the
-* original object. Arrays are also cloned, however objects inside arrays are still linked.
+* original object. Arrays and the objects inside them are cloned as well.
+*
+* Nesting depth is limited only by available memory, and circular references are reproduced in the
+* copy rather than followed forever. Two props pointing at the same object still point at one
+* shared copy afterwards.
 *
 * @param target Target can be anything
 * @param [options={}] See type {@link Options} for more details.
@@ -561,20 +569,40 @@ function assignProp(carry, key, newVal, originalObject, includeNonenumerable) {
 * @returns The target with replaced values
 */
 function copy(target, options = {}) {
-	if (isArray(target)) return target.map((item) => copy(item, options));
-	if (!isPlainObject(target)) return target;
-	const props = Object.getOwnPropertyNames(target);
-	const symbols = Object.getOwnPropertySymbols(target);
-	return [...props, ...symbols].reduce((carry, key) => {
-		if (key === "__proto__") return carry;
-		if (isArray(options.props) && !options.props.includes(key)) return carry;
-		const val = target[key];
-		assignProp(carry, key, copy(val, options), target, options.nonenumerable);
-		return carry;
-	}, {});
+	if (typeof target !== "object" || target === null) return target;
+	const clones = /* @__PURE__ */ new Map();
+	const sources = [];
+	const dests = [];
+	const result = cloneRef(target, clones, sources, dests);
+	const onlyProps = Array.isArray(options.props) ? options.props : void 0;
+	const nonenumerable = options.nonenumerable === true;
+	while (sources.length) {
+		const source = sources.pop();
+		const dest = dests.pop();
+		if (Array.isArray(source)) {
+			for (let i = 0; i < source.length; i++) if (i in source) dest[i] = cloneRef(source[i], clones, sources, dests);
+			continue;
+		}
+		if (nonenumerable) for (const key of Object.getOwnPropertyNames(source)) {
+			if (key === "__proto__") continue;
+			if (onlyProps && !onlyProps.includes(key)) continue;
+			assignProp(dest, key, cloneRef(source[key], clones, sources, dests), source);
+		}
+		else for (const key in source) {
+			if (!Object.prototype.hasOwnProperty.call(source, key)) continue;
+			if (key === "__proto__") continue;
+			if (onlyProps && !onlyProps.includes(key)) continue;
+			dest[key] = cloneRef(source[key], clones, sources, dests);
+		}
+		for (const key of Object.getOwnPropertySymbols(source)) {
+			if (onlyProps && !onlyProps.includes(key)) continue;
+			if (!nonenumerable && !Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+			assignProp(dest, key, cloneRef(source[key], clones, sources, dests), source);
+		}
+	}
+	return result;
 }
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/b5fefaeae5105e92d752f15cd158913d848e5075a9f80278488919f0941a70dd/node_modules/superjson/dist/index.js
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/superjson/2.2.6/711cee35fda0e5a37276180e7a2ecc71bd8bb1528c27c34fa53791b52a3c4054/node_modules/superjson/dist/index.js
 var SuperJSON = class {
 	/**
 	* @param dedupeReferentialEqualities  If true, SuperJSON will make sure only one instance of referentially equal objects are serialized and the rest are replaced with `null`.
@@ -648,8 +676,7 @@ SuperJSON.registerClass;
 SuperJSON.registerCustom;
 SuperJSON.registerSymbol;
 SuperJSON.allowErrorProps;
-//#endregion
-//#region src/server/utils.ts
+// src/server/utils.ts
 /**
 * Convert any PublicSchema to a JSON Schema.
 * Uses toStandardSchema to handle all schema types (Zod v4, AI SDK Schema, JSON Schema).
@@ -899,7 +926,6 @@ function convertInstructionsToString(message) {
 	}).filter((content) => content).join("\n");
 	return typeof message.content === "string" ? message.content : "";
 }
-//#endregion
 export { getWorkflowInfo as a, toSlug as c, getStoredResourceScope as i, stringify as l, assertStoredResourceScope as n, normalizeRoutePath as o, convertInstructionsToString as r, scopeStoredResourceMetadata as s, WorkflowRegistry as t };
 
-//# sourceMappingURL=utils-aoLN3Wfi.js.map
+//# sourceMappingURL=utils-YEuwVEc2.js.map